Script issue with HISTFILE

[Geoff Wild]

All admins have a seperate .sh_history file as root.

I want a script that I can run from root's cron, that will timestamp the .sh_history files of all admins still logged in as root once a day. echo `date` >> sh_history _$USER is not an option as it does NOT issue a newline correctly - IE, the next command a user enters is appened to the line of the date command...

Findings:

Whether I use a function for the routine that sets the HISTFILE or have it striaght in the flow of the srcript, even though the HISTFILE appears to be set (from testing with logging and set -x), the timestamp of each USER only goes into the first USER's .sh_history.

The only work around I found was to have the routine in a seperate script. That just seems silly to me - must be a way to incorporate this all in a single script.

Attached is a text document with results and the script(s).

Rgds...Geoff

[c_51]

instead of using: echo `date` >> sh_history
try using print -s $(date)

i beleive the -s option will print to the shell history file instead of to standard out.

The solution was presented previously on the forum. Not sure how to seach for it though.

[Geoff Wild]

If you look at my attachment, you will see I am using print -s - I was the one that posted that in the other thread..

Rgds...Geoff

[Sanjay_6]

Hi Geoff,

Have you tried
echo `date\n` >> .sh_history

Hope this helps.

Regds

[Geoff Wild]

Sanjay - yes - tried that - doesn't work. Just adds a ^J to line - and the first command executed is appended...

print -s only way to go - just would like to do it all in a single script - instead of having to call another script from the first one...

It's almost as if once you set the HISTFILE, it can't be unset (even though the export seems to work) for the duration of that shell?

Rgds...Geoff

[Muthukumar_5]

Hai Geoff,

I tried a simple one as,

# sh -x hist.sh
+ HISTFILE=/home/muthu/.sh_history
+ TEST=/home/muthu/.sh_history
+ export HISTFILE=/home/muthu/.sh_history_
+ echo HISTFILE is /home/muthu/.sh_history_
HISTFILE is /home/muthu/.sh_history_
+ /usr/bin/date
+ print -s Tue Oct 19 01:42:17 MDT 2004 still logged in as root...
+ unset HISTFILE
+ export HISTFILE=/home/muthu/.sh_history
+ echo HISTFILE after unset is /home/muthu/.sh_history
HISTFILE after unset is /home/muthu/.sh_history
# cat /home/muthu/.sh_history_
Tue Oct 19 01:42:17 MDT 2004 still logged in as root...

script
======
# point to their .sh_history file
TEST=$HISTFILE
export HISTFILE=/home/muthu/.sh_history_
# time stamp it
echo "HISTFILE is $HISTFILE"
print -s "`/usr/bin/date` $USER still logged in as root..."
unset HISTFILE
export HISTFILE=$TEST
echo "HISTFILE after unset is $HISTFILE"

Geoff,

Try to revert old history file there. Else, if you try with your script again, it will not having default HISTFILE another more there.

TEST=$HISTFILE
<.... snip ....>
export HISTFILE=$TEST

It will work there.

I tried on 11.0.

HTH.

[John Poff]

Hi Geoff,

Interesting problem. Here's a crazy idea. Maybe you could 'su' to the user and then do the 'print -s', so you would pick the HISTFILE for free and not have to worry about unsetting it. Something like this:

/bin/su - $USER -c 'print -s "`/usr/bin/date` $USER still logged in as root..."

JP

[Jeff_Traigle]

Just off the cuff, but you're last statement about HISTFILE apparently not being unset made me think of it... have you tried using a different variable name instead? Maybe the shell actually does protect the value of HISTFILE once it's set. (Not sure why it should, but stranger things have been known to happen.) Out of habit, I try to avoid using names the shell uses for its own purposes whenever possible (unless setting something like PATH).

[John Poff]

To expand on Jeff's idea, maybe you could try this also:

HISTFILE=${HOME}/.sh_history_$USER print -s "`/usr/bin/date` $USER still logged in as root..."

JP

[Geoff Wild]

Muthukumar - no luck:

tail /.sh_history_gwild

vi datestamp-root-history
datestamp-root-history
Tue Oct 19 09:04:17 MDT 2004 gwild still logged in as root...
Tue Oct 19 09:04:17 MDT 2004 user2 still logged in as root...
tail /.sh_history_gwild

Still adds the timestamp to only my (first) .sh_history...


John,

The su - USER won't work - as then I would have to su - again to root - and would need pin/fob number...this script is to only timestamp the root's .sh_history file for each admin...


Jeff - has to be HISTFILE - else how does it know which .sh_history to go to? If not, it will default to root's .sh_history - which we only have for console access..


Just an FYI - here's a snip from root's .profile:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
export HISTFILE
print -s "login at `/usr/bin/date`"
#date >>$HISTFILE
HISTSIZE=500
export HISTSIZE


And last post by John, that's what's in the script currently...

[Muthukumar_5]

I have got it now,

The new users are not having environment variable HISTFILE set there while executing there.

we can reproduce with this,

#!/bin/sh
#
# script to add a date stamp to the /.sh_history_$USER
# for those su'ed to root
# Only run from cron once a day
# gwild 2004-10-15
#set -x


#===========================================================
# Function: TimeStamp
# Description: timestamp the /.sh_history_$USER
# Arguments: none
# Returns: none
#===========================================================
function TimeStamp {
# point to their .sh_history file
TEMP=$(su -c $USER -c "echo $HISTFILE")
if [[ $? -ne 0 ]]
then
echo "$USER: Not having history file"
exit 1
fi
echo "$USER history file $HISTFILE
export HISTFILE=${HOME}/.sh_history_$USER
# time stamp it
echo "HISTFILE is $HISTFILE"
print -s "`/usr/bin/date` $USER still logged in as root..."
unset HISTFILE
HISTFILE=$TEMP
echo "HISTFILE after unset is $HISTFILE"
}



#===================================================================
# BEGIN MAIN CODE
#===================================================================

# find parent process of all users signed in as root
for i in `ps -ef |grep "\-sh"|awk '{print $3}'`
do
# just grab the user name
USER=`ps -ef |grep $i |grep -v root|awk '{print $1}'`
# TimeStamp
TimeStamp $USER
done

exit 0

HTH.

[John Poff]

Geoff,

Your attachment includes the output of your script running with 'set -x' and using the external script to do your time stamp function. Can you post the output with 'set -x' for trying it with the function? I'd be curious to see what the output is. Specifically, I'd like to see if the $USER variable is getting inside the function correctly each time. If not, you might try passing it to the function as a parameter.

I realized after I posted my 'su' idea that it wasn't quite what I had in mind. My second post is different from your script in that it sets the HISTFILE on the command line as opposed to exporting it and then unsetting it.

JP

[Geoff Wild]

John,

Here's the output using the function:

+ ps -ef
+ grep \-sh
+ awk {print $3}
+ + ps -ef
+ grep 11964
+ grep -v root
+ awk {print $1}
USER=tstewart
+ TimeStamp
HISTFILE is //.sh_history_tstewart
HISTFILE after unset is
+ + ps -ef
+ grep 8983
+ grep -v root
+ awk {print $1}
USER=gwild
+ TimeStamp
HISTFILE is //.sh_history_gwild
HISTFILE after unset is
+ + ps -ef
+ grep 737
+ grep -v root
+ awk {print $1}
USER=elocken
+ TimeStamp
HISTFILE is //.sh_history_elocken
HISTFILE after unset is
+ exit 0



Script is:

#!/bin/sh
#
# script to add a date stamp to the /.sh_history_$USER
# for those su'ed to root
# Only run from cron once a day
# gwild 2004-10-15
set -x


#===========================================================
# Function: TimeStamp
# Description: timestamp the /.sh_history_$USER
# Arguments: none
# Returns: none
#===========================================================
function TimeStamp {
# point to their .sh_history file
export HISTFILE=${HOME}/.sh_history_$USER
# time stamp it
echo "HISTFILE is $HISTFILE"
print -s "`/usr/bin/date` $USER still logged in as root..."
unset HISTFILE
echo "HISTFILE after unset is $HISTFILE"
}



#===================================================================
# BEGIN MAIN CODE
#===================================================================

# find parent process of all users signed in as root
for i in `ps -ef |grep "\-sh"|awk '{print $3}'`
do
# just grab the user name
USER=`ps -ef |grep $i |grep -v root|awk '{print $1}'`
TimeStamp
# /usr/local/bin/datestamp-root-history-TimeStamp $USER
done

exit 0


Rgds...Geoff

[Geoff Wild]

John,

Tried your way:

#!/bin/sh
#
# script to add a date stamp to the /.sh_history_$USER
# for those su'ed to root
# Only run from cron once a day
# gwild 2004-10-15
set -x


#===========================================================
# Function: TimeStamp
# Description: timestamp the /.sh_history_$USER
# Arguments: none
# Returns: none
#===========================================================
function TimeStamp {
# point to their .sh_history file
# export HISTFILE=${HOME}/.sh_history_$USER
HISTFILE=${HOME}/.sh_history_$USER
# time stamp it
echo "HISTFILE is $HISTFILE"
print -s "`/usr/bin/date` $USER still logged in as root..."
unset HISTFILE
echo "HISTFILE after unset is $HISTFILE"
}



#===================================================================
# BEGIN MAIN CODE
#===================================================================

# find parent process of all users signed in as root
for i in `ps -ef |grep "\-sh"|awk '{print $3}'`
do
# just grab the user name
USER=`ps -ef |grep $i |grep -v root|awk '{print $1}'`
TimeStamp
# /usr/local/bin/datestamp-root-history-TimeStamp $USER
done

exit 0


Same thing:

+ ps -ef
+ grep \-sh
+ awk {print $3}
+ + ps -ef
+ grep 11964
+ grep -v root
+ awk {print $1}
USER=tstewart
+ TimeStamp
HISTFILE is //.sh_history_tstewart
HISTFILE after unset is
+ + ps -ef
+ grep 8983
+ grep -v root
+ awk {print $1}
USER=gwild
+ TimeStamp
HISTFILE is //.sh_history_gwild
HISTFILE after unset is
+ + ps -ef
+ grep 737
+ grep -v root
+ awk {print $1}
USER=elocken
+ TimeStamp
HISTFILE is //.sh_history_elocken
HISTFILE after unset is
+ exit 0


Yet, only .sh_history_tstewart has the timestamp(s):


# tail /.sh_history_tstewart

Tue Oct 19 09:58:55 MDT 2004 tstewart still logged in as root...
Tue Oct 19 09:58:55 MDT 2004 gwild still logged in as root...
Tue Oct 19 09:58:55 MDT 2004 elocken still logged in as root...

[Jeff_Traigle]

Gotcha... I must have missed the previous thread or something... so print -s prints to the history file so HISTFILE must be set and trying to write directly with echo to the history file mangles things in the file. I'm slow some days, but I eventually come around. :)

Well, I did some testing from the command line and it appears that the shell will only use the first setting of HISTFILE as you've observed in your script. (I tried both having it set initially from /.profile and unset initially... both cases print -s would only use the first set value.)

It works when timestamp is a separate script because you unset HISTFILE (or it's not set initially actually since it's running from cron in your case) before calling it. Thus each invocation of the timestamp script sets it and, since it's the first setting for that invocation, the print -s writes to the file you intend. When it's a function within the same script, you're restricted to writing to the file specified in the first setting of HISTFILE.

Given the shell behavior, it doesn't look like you can avoid having separate scripts (or I'm just not ingenius enough today to figure out how to work around it).

[Geoff Wild]

Muthukumar - your lastest post with su - $USER didn't work...

Had to modify slightly - as it errored on second root user with:

/usr/local/bin/datestamp-root-history.Muthukumar
+ ps -ef
+ grep \-sh
+ awk {print $3}
+ + ps -ef
+ grep 11964
+ grep -v root
+ awk {print $1}
USER=tstewart
+ TimeStamp tstewart
tstewart history file //.sh_history_gwild
HISTFILE is //.sh_history_tstewart
HISTFILE after unset is (c)Copyright 1983-2000 Hewlett-Packard Co., All Rights Reserved.
(c)Copyright 1979, 1980, 1983, 1985-1993 The Regents of the Univ. of California
(c)Copyright 1980, 1984, 1986 Novell, Inc.
(c)Copyright 1986-1992 Sun Microsystems, Inc.
(c)Copyright 1985, 1986, 1988 Massachusetts Institute of Technology
(c)Copyright 1989-1993 The Open Software Foundation, Inc.
(c)Copyright 1986 Digital Equipment Corp.
(c)Copyright 1990 Motorola, Inc.
(c)Copyright 1990, 1991, 1992 Cornell University
(c)Copyright 1989-1991 The University of Maryland
(c)Copyright 1988 Carnegie Mellon University
(c)Copyright 1991-2000 Mentat Inc.
(c)Copyright 1996 Morning Star Technologies, Inc.
(c)Copyright 1996 Progressive Systems, Inc.
(c)Copyright 1991-2000 Isogon Corporation, All Rights Reserved.


RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the U.S. Government is subject to
restrictions as set forth in sub-paragraph (c)(1)(ii) of the Rights in
Technical Data and Computer Software clause in DFARS 252.227-7013.

Hewlett-Packard Company
3000 Hanover Street
Palo Alto, CA 94304 U.S.A.

Rights for non-DOD U.S. Government Departments and Agencies are as set
forth in FAR 52.227-19(c)(1,2).
//.sh_history_gwild
logout
+ + ps -ef
+ grep 8983
+ grep -v root
+ awk {print $1}
USER=gwild
+ TimeStamp gwild
ksh: syntax error at line 1 : `(' unexpected
gwild: Not having history file

So tried without the -:

TEMP=$(su $USER -c "echo $HISTFILE")

# /usr/local/bin/datestamp-root-history.Muthukumar
+ ps -ef
+ grep \-sh
+ awk {print $3}
+ + ps -ef
+ grep 11964
+ grep -v root
+ awk {print $1}
USER=tstewart
+ TimeStamp tstewart
tstewart history file //.sh_history_gwild
HISTFILE is //.sh_history_tstewart
HISTFILE after unset is //.sh_history_gwild
+ + ps -ef
+ grep 8983
+ grep -v root
+ awk {print $1}
USER=gwild
+ TimeStamp gwild
gwild history file //.sh_history_gwild
HISTFILE is //.sh_history_gwild
HISTFILE after unset is //.sh_history_gwild
+ + ps -ef
+ grep 737
+ grep -v root
+ awk {print $1}
USER=elocken
+ TimeStamp elocken
elocken history file //.sh_history_gwild
HISTFILE is //.sh_history_elocken
HISTFILE after unset is //.sh_history_gwild
+ exit 0

And yet again - it only updates the first /.sh_history_$USER

Rgds...Geoff

[Jeff_Traigle]

Would it be possible to run something like:

su - ${USER} -c "print -s $(date)"

for each user in this script? That would start a new shell with their login environment set (HISTFILE included) and should write to the appropriate file with each invocation.

[Geoff Wild]

Jeff - nope - John suggested that above - sorry - has to go to "root's" .sh_history file - not the user's .sh_history...

Rgds...Geoff

[John Kittel · Accepted solution]

I haven't read and grocked all the posts in this thread, so excuse me if I'm covering old ground here.

I did some playing around with some test scripts. It appears that if I group the export of HISTFILE and the print -s into a subshell, it works. Here is an example:

#!/bin/sh
echo "HISTFILE is $HISTFILE"
HISAVE=$HISTFILE
(export HISTFILE=/root/.sh_this3; echo "HISTFILE is $HISTFILE"; print -s "this3"
)
(export HISTFILE=/root/.sh_this4; echo "HISTFILE is $HISTFILE"; print -s "this4
")
HISTFILE=$HISAVE
echo "HISTFILE is $HISTFILE"

HTH, John

[Jeff_Traigle]

Argh. Right. HISTFILE is set by invoking user... from cron, root is the invoking user... can't run it from crons by the admin users because su to root requires authentication... ok, I'm stumped for now other than keeping it in separate scripts.

[Jeff_Traigle]

Hmmm.... should have thought of that... Mr. Kittel might be onto something there... subshell within the script should act the same as a completely separate script, I would think... maybe the following will do the trick.

#!/bin/sh
#===========================================================
# Function: TimeStamp
# Description: timestamp the /.sh_history_$USER
# Arguments: none
# Returns: none
#===========================================================
function TimeStamp {
(
# point to their .sh_history file
export HISTFILE=${HOME}/.sh_history_$USER
# time stamp it
echo "HISTFILE is $HISTFILE"
print -s "`/usr/bin/date` $USER still logged in as root..."
)
}



#===================================================================
# BEGIN MAIN CODE
#===================================================================

# find parent process of all users signed in as root
for i in `ps -ef |grep "\-sh"|awk '{print $3}'`
do
# just grab the user name
USER=`ps -ef |grep $i |grep -v root|awk '{print $1}'`
TimeStamp
done

exit 0

[Geoff Wild]

John Kittel - woohoo - I was thinking along those lines - couldn't figure it out - even tried sh -c....

Here's the final script (embedded and attached):

#!/bin/sh
#
# script to add a date stamp to the /.sh_history_$USER
# for those su'ed to root
# Only run from cron once a day
# gwild 2004-10-15 with help from jkittle


#===========================================================
# Function: TimeStamp
# Description: timestamp the /.sh_history_$USER
# Arguments: none
# Returns: none
#===========================================================
function TimeStamp {
# point to their .sh_history file
# time stamp it
echo "HISTFILE is $HISTFILE"
(export HISTFILE=${HOME}/.sh_history_$USER; echo "HISTFILE is $HISTFILE"; print -s "`/usr/bin/date` $USER still logged in as root.
..")
#print -s "`/usr/bin/date` $USER still logged in as root..."
unset HISTFILE
echo "HISTFILE after unset is $HISTFILE"
}



#===================================================================
# BEGIN MAIN CODE
#===================================================================

# find parent process of all users signed in as root
for i in `ps -ef |grep "\-sh"|awk '{print $3}'`
do
# just grab the user name
USER=`ps -ef |grep $i |grep -v root|awk '{print $1}'`
TimeStamp
done

exit 0


Thanks all for helping.

Rgds...Geoff